Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 17 hours ago
48,168 skills
- correctmichael-denyer/pstack-claudeFind the mistakes agents keep repeating in this repo and make each one impossible. Try architecture first, then types, then a lint whose error names the fix, then a test, and write docs last. Prove each check fails on a real past mistake. Repeat this each time the operator corrects you. Use for /correct.TestingNo warnings★ 3.7K↓ —
- solana-vulnerability-scannertrailofbits/skillsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.SecurityNo warnings★ 7.9K↓ —
- chrome-mcp-troubleshootingtrailofbits/skillsDiagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.BrowserNo warnings★ 7.9K↓ —
- groq-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Groq rate limit handling with backoff, queuing, and header parsing. Use when handling rate limit errors, implementing retry logic, or optimizing API request throughput for Groq. Trigger with phrases like "groq rate limit", "groq throttling", "groq 429", "groq retry", "groq backoff".EngineeringNo warnings★ 2.9K↓ —
- impeccableUpdatedpbakaus/impeccableUse when the user wants to design, redesign, shape, critique, audit, polish, simplify, harden, animate, or otherwise improve a frontend interface: websites, landing pages, dashboards, product UI, components, forms, settings, onboarding, empty states, and native iOS or Android screens. Handles UX review, hierarchy, layout, typography, color, motion, UX copy, accessibility, responsive behavior, edge cases, and capturing or documenting design systems (DESIGN.md, tokens). Also for making bland UI bolder, loud UI quieter, or ambitious visual effects. Not for backend-only or non-UI tasks.DesignNo warnings★ 97.8K↓ —
- versioning-apisjeremylongshore/tons-of-skills-marketplaceImplement API versioning with backward compatibility, deprecation notices, and migration paths. Use when managing API versions and backward compatibility. Trigger with phrases like "version the API", "manage API versions", or "handle API versioning".EngineeringNo warnings★ 2.9K↓ —
- skill-positioning-analysisZJU-REAL/Easel差异化定位分析：帮账号/品牌找到差异化定位——扫描赛道、给竞品定位坐标、识别空白机会、 从人群/场景/价值/形式/人设多维找差异点，凝练一句话定位并给落地建议。当用户说"差异化定位" "怎么和竞品区分""我的定位是什么""找差异化""赛道分析""定位分析""怎么突出""同质化怎么办" "找我的独特点"时使用。OtherNo warnings★ 4.2K↓ —
- shipplugin87/ux-ui-agent-skillsPre-release gate. Run the full gate, responsive + render checks, then produce the release checklist (README badge/current/changelog). Use before tagging a release.MediaNo warnings★ 3.1K↓ —
- wycheprooftrailofbits/skillsValidates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input.TestingNo warnings★ 7.9K↓ —
- open-design-landingnexu-io/open-designProduce a world-class single-page editorial landing site in the Atelier Zero visual language (Monocle / Apartamento / Études editorial collage) — the same aesthetic OpenDesign uses for its own marketing surface. The agent fills a typed `inputs.json` from a brand brief, optionally generates 16 collage assets via gpt-image-2, then runs a pure-function composer that emits a self-contained HTML file. Drop-in scroll-reveal motion and a Headroom-style sticky nav are wired automatically.DesignNo warnings★ 105.1K↓ —
- prisma-postgres-setupprisma/skillsObtain or reuse a Prisma Postgres database and connect an application. Use when the user needs a database and has none configured ("I need a database", "add a Postgres database", "set up a database for this app"), runs or mentions `create-db` or `npx create-db`, or asks to set up or connect Prisma Postgres, including in v0 and the Vercel Marketplace. Hands Prisma ORM configuration to prisma-orm-setup; reuses an existing connection first and honors an explicit provider, driver, alternative ORM, or database-only choice.OfficialDataNo warnings★ 77↓ —
- thought-partnerjeremylongshore/tons-of-skills-marketplaceCollaborative thinking partner for exploring ideas, challenges, and decisions. Use when the user needs to analyze ambiguity, test assumptions, or compare options. Trigger with "think through", "explore", "brainstorm", "help me figure out", or an open-ended strategy or priority question.TestingNo warnings★ 2.9K↓ —
- impeccableUpdatedpbakaus/impeccableUse when the user wants to design, redesign, shape, critique, audit, polish, simplify, harden, animate, or otherwise improve a frontend interface: websites, landing pages, dashboards, product UI, components, forms, settings, onboarding, empty states, and native iOS or Android screens. Handles UX review, hierarchy, layout, typography, color, motion, UX copy, accessibility, responsive behavior, edge cases, and capturing or documenting design systems (DESIGN.md, tokens). Also for making bland UI bolder, loud UI quieter, or ambitious visual effects. Not for backend-only or non-UI tasks.DesignNo warnings★ 97.8K↓ —
- neon-authneondatabase/agent-skillsAdd authentication to a new app. Use for "add auth", "add login", Neon Auth (Managed Better Auth), identity routing, sign-up, sign-in, password reset, email OTP, magic links, organizations, phone OTP, OAuth, OAuth server for MCP or third-party OAuth clients, passkeys, MFA, trusted domains, invalid domain, and @neon/auth. No existing identity: default to Managed Better Auth. Keep working Better Auth, Clerk, Supabase Auth, or another IdP. User asked to migrate from Supabase Auth: Managed Better Auth. A required plugin outside Managed support: self-managed Better Auth on a Neon Function or the existing app host. Also use for auth APIs in @neon/neon-js.OfficialProductivityNo warnings★ 108↓ —Also in 1 other repo
- implement-patchtrailofbits/skillsUse when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.TestingNo warnings★ 7.9K↓ —
- firebase-ai-logic-basicsfirebase/agent-skillsIntegrates Firebase AI Logic (formerly Vertex AI for Firebase) into mobile and web apps (Android, iOS, Web, and Flutter) to call Gemini models from client code. Use when provisioning or initializing Firebase AI Logic, or adding Gemini features to an app: text generation, multimodal input, chat, streaming, structured output, hybrid on-device inference, App Check protection, or switching models with Remote Config.OfficialEngineeringNo warnings★ 495↓ —
- reproduce-bugtrailofbits/skillsUse when a named runtime or compiler bug in a local repository needs independent reproduction.OtherNo warnings★ 7.9K↓ —
- mode-creatorthedotmack/claude-memInteractively create, install, activate, and verify custom claude-mem modes, including domain-specific observation types, concept tags, optional Telegram alerts, bot setup, worker restart, and startup-context verification. Use this whenever someone asks to customize what claude-mem remembers, create or change a mode, track domain-specific notes, add observation types or tags, or send Telegram notifications for particular memories—even if they do not use the word "mode."PlanningNo warnings★ 107.2K↓ —
- patching-bugstrailofbits/skillsUse when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.EngineeringNo warnings★ 7.9K↓ —
- humanize-pptnexu-io/open-designA presentation system for agent-made PPTs — born for the talk, not just the template. It turns raw material into an AST (audience-state-transfer) outline with per-page visual-enhancement decisions (image / SVG diagram / video), hands a production brief to a downstream renderer (HTML-PPT skills or native PPTX), then runs a capped 3-round presentation checkup (演讲体检) on the rendered deck. It never renders slides itself. Use before generating PPT/HTML slides from raw material, and after rendering when the user says things like "给这份 deck 做演讲体检" or "PPT 渲染质检". If all you want is one beautiful template page with no outline and no checkup, a rendering skill alone is enough.WritingNo warnings★ 105.1K↓ —
- szamlazz-invoicingdavepoon/buildwithclaudeIssue, cancel, and fetch Hungarian invoices via the szamlazz.hu Agent API. Handles VAT calculation, NAV taxpayer lookup, partner caching, and PDF generation. Use when the user mentions számla, számlázás, invoice, sztornó, díjbekérő, proforma, or wants to bill a customer.DocumentsNo warnings★ 3.7K↓ —
- dwarf-experttrailofbits/skillsAnalyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).WritingNo warnings★ 7.9K↓ —
- yt-ideationjeremylongshore/tons-of-skills-marketplaceGenerate filmable YouTube video ideas, explain their evidence and priority, and save user selections for briefing. Use when planning content from research or a topic. Trigger with "video ideas", "what should I make next" or "brainstorm videos".MediaNo warnings★ 2.9K↓ —
- code-formatterjeremylongshore/tons-of-skills-marketplaceExecute automatically formats and validates code files using Prettier and other formatting tools. Use when users mention "format my code", "fix formatting", "apply code style", "check formatting", "make code consistent", or "clean up code formatting". Handles JavaScript, TypeScript, JSON, CSS, Markdown, and many other file types. Trigger with relevant phrases based on skill purpose.EngineeringNo warnings★ 2.9K↓ —
sharp-edges
trailofbits/skills
SecurityUpdated 4 days ago
From the author
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.
Install
npx skills add trailofbits/skills --skill sharp-edges -a claude-code
Installs to .claude/skills/sharp-edges/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (19)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/auth-patterns.md
- references/case-studies.md
- references/config-patterns.md
- references/crypto-apis.md
- references/lang-c.md
- references/lang-csharp.md
- references/lang-go.md
- references/lang-java.md
- references/lang-javascript.md
- +7 more